Privacy Policy — Canada
Last updated August 7, 2026 · Law 25 (Québec) and PIPEDA
This policy explains how NESTOR LOGIC ("we," "us") collects, uses, discloses and protects personal information in Canada. It reflects our obligations under Québec's Act respecting the protection of personal information in the private sector, as amended by Law 25, and the federal Personal Information Protection and Electronic Documents Act (PIPEDA).
Who this covers
NESTOR LOGIC is based in Montréal, Québec. This policy applies to personal information we handle about visitors to this website, prospective clients, and the authorized users of our platform.
When we operate the platform on behalf of a business client, we act as a service provider following that client's instructions. In that case the client is responsible for its own privacy notices to its customers, and this policy covers only our own handling.
Person responsible for privacy
Law 25 requires every organization to designate a person responsible for the protection of personal information, and to publish that person's title and contact details. Ours holds the title of Privacy Officer and is reachable at privacy@nestorlogic.ai. Write to them with any question, request or complaint — that address reaches the person who answers it, not a queue.
What we collect
| Category | Examples |
|---|---|
| Contact and account | Name, business role, email address, phone number, sign-in details. |
| Business details | Company name and address, and the information needed to set up and bill an account. |
| Platform credentials | Access details you authorize us to use on the platforms you connect. |
| Usage and technical | Log data, IP address, device and browser information, and actions recorded in the audit trail. |
| Communications | Support requests, correspondence, and approval messages you send or receive. |
Why we use it
We use personal information to provide and secure the platform, verify users and process owner approvals, propagate approved changes to the platforms you connect, maintain the audit record, respond to support requests, handle billing, meet legal obligations, and improve the service. We collect it for these purposes and, where the law requires, with your consent. If we ever want to use information for a materially different purpose, we will ask first.
Consent
We rely on consent that is clear, free and informed, and we ask for express consent where information is sensitive. You can withdraw consent at any time, subject to legal and contractual limits. Withdrawing consent may mean we can no longer provide part of the service.
Where information is stored, and for how long
Client data on the platform is hosted on our Montréal-based infrastructure, with an immutable audit record of approved changes. Information is retained only as long as needed for the purposes described above or as required by law, after which it is destroyed or anonymized. These are the periods we work to:
| Information | How long we keep it |
|---|---|
| Account and contact details | For as long as the account is open, then 24 months after it closes so we can meet tax, contract and audit obligations. |
| Enquiries that never become accounts | 24 months from our last exchange with you, then deleted. |
| Compliance scan results | 12 months. The one free scan per visitor is counted using a one-way hash, never the address itself, and that hash is kept 30 days. |
| Sign-in and technical logs | 12 months. |
| The approval audit trail | Kept for the life of the account and never edited — it is the record that proves what changed and who approved it, so we keep it for as long as that proof could be needed. |
On data location
Law 25 is not a data-localization law. It permits personal information to be handled outside Québec where a proper assessment has been carried out. We host in Québec because it removes that assessment burden — not because the law requires it. We think the distinction is worth stating plainly.
Who we share it with
We share personal information only with the service providers who help us operate, and only under agreements that limit what they can do with it. There are four, and this is where each one holds the information: hosting, databases and file storage — Beauharnois, Québec; transactional email — Montréal, Québec; payment processing — Canada; and edge protection (the DNS and firewall layer in front of the site) — traffic passes through it, and no client information is stored there. We use no analytics or advertising providers. We do not sell personal information. We may disclose information where the law requires it, to protect our rights, or in connection with a corporate transaction, in each case as permitted by Law 25 and PIPEDA.
Information handled outside Québec
Before personal information is handled outside Québec, Law 25 requires an assessment of privacy-related factors, including the legal framework where it would be handled. Where a service provider operates outside Québec, we carry out that assessment and put contractual protections in place.
Cookies
This website sets three cookies, and all three are necessary: one that keeps you signed in, one that remembers which language you chose, and one that records your answer to the cookie banner. We run no analytics, advertising or profiling cookies at all. If we ever add one, it stays switched off until you turn it on — Law 25 requires any function capable of identifying, locating or profiling someone to be off by default, and ours are. You can change your answer at any time from the cookie banner, or clear cookies in your browser settings.
Automated processing
Our compliance scanner produces assessments about websites, not decisions about individuals. If we ever make a decision about someone based exclusively on automated processing, we will tell them and give them the opportunity to submit observations, as the law requires.
Children and young people
Our service is sold to businesses and is not directed at children. We do not knowingly collect personal information from anyone under 14, and we do not open accounts for them. Under Law 25, information about a child under 14 may only be collected with the consent of a parent or guardian, and information about a minor is treated as sensitive by default — we apply that standard. If you believe a child has given us personal information, write to privacy@nestorlogic.ai and we will delete it.
Your rights
Subject to legal limits, you may access the personal information we hold about you, have it corrected, withdraw your consent, receive a copy in a structured, commonly used technological format, and ask us to stop disseminating information or de-index certain results where the law allows. Write to privacy@nestorlogic.ai and we will answer within 30 days, the deadline Law 25 sets.
Confidentiality incidents
If an incident involving personal information presents a risk of serious injury, we will notify the Commission d'accès à l'information and the people affected. The law requires this to be done with diligence; we hold ourselves to a fixed deadline instead — within 72 hours of becoming aware of the incident, and sooner where we can. We maintain a register of incidents, and every incident goes in it whether or not it was reportable.
Complaints
If our response does not resolve your concern, you may contact the Commission d'accès à l'information du Québec, or the Office of the Privacy Commissioner of Canada for matters under PIPEDA.
Changes to this policy
We may update this policy. The date at the top shows the current version, and we will give notice of material changes.
How we describe what we do
NESTOR LOGIC is built to help businesses reduce their compliance exposure and maintain a documented, good-faith record of the steps they have taken. We do not guarantee compliance with any law, and nothing on this site is legal advice. For advice about your own obligations, consult a qualified lawyer in your jurisdiction.